Splunk Search

Writing rex to grep a value from the field

nivethainspire_
Explorer

I have 3 different values to be extracted. Please help me in writing rex command

here is the field values
name="ascd23:deo"
name="adcs44.sys.com"
name="aswdc-w.foul.com"

I need values as below
name=ascd23
name=adcs44
name=aswdc-w
I need a rex command

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

So... everything before the first dot or colon, not including quotes?

If you already have the name field key-value-extracted, try this:

... | rex field=name "^(?<name>[^.:]+)"

If you don't already have the name field, try this:

... | rex "name=\"(?<name>[^.:\"]+)"

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

So... everything before the first dot or colon, not including quotes?

If you already have the name field key-value-extracted, try this:

... | rex field=name "^(?<name>[^.:]+)"

If you don't already have the name field, try this:

... | rex "name=\"(?<name>[^.:\"]+)"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...